Definition of Prohibited Subject Identifiers in Clinical Trials 

Who We Are Company Resources Vendor Resources Definition of Prohibited Subject Identifiers

For our vendors

ICH-GCP, data protection regulations and laws on patient confidentiality require that clinical trial sponsors and Contract Research Organisations (outside monitoring activity) are not provided with the identities of trial subjects. The same rule will apply to any GXP vendor in receipt of subject level data, who does not need to know the identity of trial subjects. There is often some confusion as to the data fields that should be eliminated to protect the identity of trial subjects. We have a definition of these so-called Prohibited Subject Identifiers (“PSI”).  So that our appointed GXP vendors may apply necessary Standard Operating Procedures to manage the unauthorised disclosure to them of PSI, below is our definition. 

Definition of Prohibited Subject Identifiers:

Items of information relating to a subject which either directly reveal that person’s identity or which could allow a sufficiently motivated individual to identify that subject with relative ease, including: name (in full or part ,i.e., first name or surname); signature; home address; telephone number; email address; health insurance number; government issued identification number (e.g., social security number; national health service number); and full facial photograph. Hometown/city alone is not considered an “address” and is not a prohibited subject identifier. Unless otherwise specified by the Client Company (where allowed by applicable law), real subject initials will also be considered a prohibited subject identifier. Full date of birth may also be considered a prohibited subject identifier in certain jurisdictions (see below). Single institution hospital numbers are not regarded as Prohibited Subject Identifiers. Prohibited subject identifiers may relate to the subject, or may refer to the subject’s parents, next of kin, witness, or other representative (particularly in the case of minors or incapacitated adults). 

Our policy  

For a number of legitimate reasons, we acknowledge that full date of birth can continue to be collected where law allows (see Country Regulatory Restrictions). However, it is our policy that real subject initials are no longer collected; dummy initials may be used instead.

Country regulatory restrictions 

European data protection (“DP”) and clinical authorities sometimes require that real patient initials and full date of birth are NOT collected in studies. Often the advice from the authorities is not 100% clear, but this is the latest position to the best of our knowledge:  

Real subject initials are not to be collected in:  

  • Belgium (Requirement of FAMPH, Federal Agency for Medicines and Health products as interpreted by the main EC: UZ Leuven; UZ Gent, and ULB Erasme) 
  • Finland (when full date of birth is collected / Requirement of FIMEA, clinical regulator)  
  • Germany (according to the Federal Data Protection Authority, collecting real initials would render clinical data as not sufficiently pseudonymized. BfArM – Federal Institute for Drugs and Medical Devices – has indicated that the collection of real initials is forbidden)  
  • Italy (Interpreted to be a requirement of data protection law, after prosecution of large pharmaceutical company by the Italian DP authority)  
  • Netherlands (Requirement of CCMO, clinical regulator)  
  • Spain (Interpreted to be a requirement of data protection law by industry body, Farmaindustria)  
  • Switzerland (Requirement of Swissethics) 
  • Portugal: if collected along with the full DoB (Guidelines published by the CEIC, 17 October 2018) 

It is recommended that real subject initials are not collected in these countries: 

  • Austria (Position not confirmed, but reported by Regulatory)  
  • Estonia (Position not confirmed, but reported by Clinical)  
  • Czech Republic (Position not confirmed, but Clinical reports a recommendation from EC/RA to collect dummy initials) 
  • Japan (Interpreted to be a requirement by JPMA, association of pharmaceutical manufacturers, based on the fact that only data relevant for clinical trial efficacy and safety should be collected, hence this data should only be collected where it is clearly required to support efficacy and safety, otherwise this data should be avoided)  

Dummy initials are an acceptable alternative to real initials in all jurisdictions. 

Full date of birth (DD/MMM/YYYY) is not to be collected in:  

  • Belgium (Requirement of FAMPH, Federal Agency for Medicines and Health products; if due to the nature of the study, collection of full DoB is scientifically justified, EC approval must be obtained) 
  • Finland (when real patient initials are collected / Requirement of FIMEA, clinical regulator) 
  • France (either for Clinical Trials or Non-Interventional studies, only age or partial date of birth (MM/YYYY) are allowed; full DoB is allowed only if necessary and relevant for research in patient population under 2 years of age. Requirement of the National Data Protection Commission, CNIL)  
  • Germany [according to the Federal Data Protection Authority, collecting full DOB would render clinical data as not sufficiently pseudonymized. BfArM – Federal Institute for Drugs and Medical Devices – has indicated that collecting full DoB is forbidden, and that exceptions to this prohibition (for example, clinical trials with infants) must be assessed and approved by the BfArM and the relevant EC “in exceptional cases and only in specifically justified cases”)]  
  • Portugal: if collected along with the real initials (Guidelines published by the CEIC, 17 October 2018) 
  • Spain (full DoB is generally not prohibited in Spain; however, per CEIm – FEB2018 – if real initials or other direct or indirect identifiers are collected for whatever reason, only partial DoB – MMYYYY or YYYY – would be allowed) 
  • Switzerland (Requirement of Swissethics; if the CRF foresees the recording of full date of birth, only the year should be completed and the fields for day and month should be crossed out (“–/—/YYYY”) or filled as “01/JAN/YYYY”; only in justified exceptional cases (e.g. pediatric oncology studies), Swissethics accept the use of month and year of birth or of full date of birth) 

It is also recommended that full date of birth is not collected in these countries:  

  • Austria (Position not confirmed, but reported by Regulatory)  
  • Estonia (Position not confirmed, but reported by Clinical)  
  • Czech Republic (Position not confirmed, but Clinical reports a recommendation from EC/RA to collect Year of Birth only) 
  • Japan (interpreted to be a requirement of JPMA, association of pharmaceutical manufacturers, based on the fact that only data relevant for clinical trial efficacy and safety should be collected, hence this data should only be collected where it is clearly required to support efficacy and safety, otherwise this data should be avoided) 
  • Netherlands: per CCMO (Clinical Regulator) full DoB may be collected if it is necessary for the study; the necessity must be justified in the Protocol. Last update: 11OCT2022 
  • Slovenia: requirement of JAZMP, the Slovenian Public Agency for Medicines and Medical Devices. if justified and consented, the full date of birth can be collected, otherwise the year of birth or the age should be used. If, during a GCP inspection, JAZMP finds that full DoB has been collected, they will inform the Information Commissioner (Slovenian Supervisory Authority). 

Partial date of birth (MM/YYYY) is regulated in some countries, as described above. In the absence of specific guidance on partial date of birth, it may be collected where it is scientifically relevant for the study, though like with full DoB, approvals from RAs or ECs in specific cases can’t be discounted. Age or year of birth is acceptable in all jurisdictions. 

Note: For each specific project in which they are engaged, GXP vendors should check with study teams on the exact definition of PSI that should be adopted, in case a sponsor has instructed some variation from the definition set out above.